Data brokers face state-level deletion mandates

State authorities are increasingly bypassing federal inaction to curb data broker abuses through direct deletion mandates. California’s Privacy Protection Agency launched the Delete Request and Opt-Out Platform (DROP), a tool that has already processed requests for 560,000 residents to force brokers to purge personal information and cease sales (Stephanie T. Nguyen from The Division of Field Notes, Stephanie T. Nguyen from The Division of Field Notes). Connecticut expanded this approach in May 2026 by granting consumers the right to delete profiles generated from publicly available information, including inferences derived from collated data, effectively targeting the aggregation engines used by firms like Spokeo.

These state-run mechanisms function by creating a centralized interface where individuals can systematically revoke the commercial rights to their digital footprints. While federal regulators have historically relied on disclosure-based frameworks, these state initiatives prioritize upstream restrictions on data collection and sharing, forcing companies to rebuild their compliance architecture to accommodate deletion requests at scale.

The legal landscape remains volatile as industry coalitions, led by Spokeo, have filed federal lawsuits to challenge these state mandates, arguing against the regulatory reach into their data-intelligence services. Despite these challenges, the shift toward state-led data sovereignty forces platforms to adapt their internal data governance to survive in markets where consumers can now legally demand the erasure of their digital profiles.